On top of 21 million Social Security numbers, 5.6 million fingerprints also stolen from hacked U.S. government agency

Back in April of this year, the US government’s Office of Personnel Management was hacked, seeing the ID, security clearance, Social Security numbers, names, addresses, and biometric data of 21 million former and current US government employees leaked into the wild. Now, the White House has just confirmed that a total of 5.6 million fingerprint records were also stolen from OPM, nearly five times more than the suspected 1.1 million.

With fingerprint data increasingly considered the “end-all” of identity proof, the risk of identity theft could potentially be on the rise. Breaches of this nature are especially worrisome because biometric data is permanent, unlike passwords or Social Security numbers; not to mention that high-resolution images are all that highly skilled hackers need to duplicate fingerprints .

But now that the damage is done, the urgency of the issue was downplayed by the OPM, which casually commented in a statement: “an inter-agency working group [FBI, Pentagon, and DHS] with expertise in this area … will review the potential ways adversaries could misuse fingerprint data now and in the future.” OPM will shortly beginning contacting all those affected.

The failure is not entirely without fault, upsetting lawmakers on Capitol Hill who condemned the agency’s response, claiming that a strong contingency plan should’ve been place. Senator Ben Sasse of Nebraska criticized OPM for releasing these developments at a time that corresponds with the Pope’s visit to Washington, suggesting the agency is treating the issue more as a PR crisis that needs to be shoveled under the rug, than as a national security crisis: “Today's blatant news dump is the clearest sign yet that the administration still acts like the OPM hack is a PR crisis instead of a national security threat.”

While no fingers are officially pointed, China is known to be assembling a massive database of US government employees and is thereby widely suspected as being responsible for the breach. Ironically, People’s Republic of China president Xi Jinping is visiting the US just as these recent developments have come to light.

Source: Washington Post